[01:06:12] <tgr_>	 wikitech is group 1, right?
[01:06:38] <tgr_>	 the only way to get a SUL3 login there should be if you have the opt-in global preference set
[01:57:12] <Krinkle>	 tgr_: that's set automatically if I've used sul3 once and/or most recently?
[01:58:48] <Krinkle>	 ah, I think I know whats going on
[01:58:58] <Krinkle>	 I clicked create account by accident on mobile before going to login
[01:59:04] <Krinkle>	 I'm guessing that placed a sticky cookie
[01:59:13] <Krinkle>	 anyway, it obviousluy should work regardless of why I'm using sul3
[01:59:29] <Krinkle>	 unless sul3 login on mobile safari is expected to be broken
[01:59:39] <Krinkle>	 s/expected to be broken/known to not yet work/
[02:00:51] <Krinkle>	 yeah, 1) wikitech logout, 2) login goes local, 3) create account goes to auth domain, 4) back, 5) on local page login now goes to auth domain too. 
[02:00:54] <Krinkle>	 anyway, no problem.
[02:01:04] <Krinkle>	 repro'ing with debug trace now
[02:02:05] <Krinkle>	 Special:WikimediaDebug not available over auth.wikimedia
[02:02:14] <Krinkle>	 and not a wildcard domain
[02:05:20] <Krinkle>	 I can reproduce it on desktop safari as well, and does not depend on the "create account > login" pathway.
[02:05:25] * Krinkle creates task
[02:48:38] <Krinkle>	  I couldn't get Special:WikimediaDebug to work in Safari even by manually setting it on the auth domain. The routing works but the "log" attribute appears to get lost on both auth domain and local, same when I use the special page normally in Firefox. It's not doing verbose logging.
[03:04:19] <Krinkle>	 ref T389318
[03:04:20] <stashbot>	 T389318: Unable to login via SUL3 on wikitech.wikimedia.org ("Session hijacking" error) - https://phabricator.wikimedia.org/T389318
[10:41:05] <tgr_>	 the opt-in flag is so far only set on signup
[10:55:42] <tgr_>	 Krinkle: 'log' works for me. Note the cookie has to be encoded (e.g. 'backend%3Dk8s-mwdebug%3Blog').
[15:56:21] <Krinkle>	 tgr_: ack I'm using the same encoding as set by the special page
[19:17:29] <tgr_>	 hm yeah it doesn't seem to be working
[19:18:41] <tgr_>	 backend%3Dmwdebug2002.codfw.wmnet%3Blog works, backend%3Dmwdebug2002.codfw.wmnet%3Blog%3Bexpire%3D1742415486 does not
[21:00:18] <Krinkle>	 ah, so if you trim off the expiry attribute it works.
[21:00:19] <Krinkle>	 interesting
[21:01:19] <Krinkle>	 gonna dig in on mwdebug locally now to figure out what's up
[21:01:25] <Krinkle>	 https://gerrit.wikimedia.org/g/operations/mediawiki-config/+/fa8162eff032ed6b971d8c3c7f366fbbf71d2464/src/XWikimediaDebug.php#51
[21:01:27] <Krinkle>	 prolly something there
[21:14:17] <tgr_>	 it's a vcl bug, I added you to the patch